South African telecommunications operators will only act on a request for lawful interception of communication across their networks once a court has instructed it.

The companies have moved to reassure their clients in this regard following startling revelations on Friday morning by Vodafone that secret wiretaps into networks in many of the 29 countries in which it operates have allowed government agencies to listen into and record live telephone conversations and even track people’s whereabouts.

Vodafone said it could not disclose whether the practice was happening in South Africa, because local law prevents it from doing so.

Vodafone, which is the world’s second largest mobile operator by subscribers, revealed that it had released the Law Enforcement Disclosure Report, “in order to push back against the increasingly widespread use of phone and broadband networks to spy on citizens”, according to a report in the Guardian.

In South Africa, section 30 the Regulation of Communications and Provision of Communication-Related Information Act — better known as Rica — requires that service providers must build networks that can be intercepted.

Internet Service Providers’ Association regulatory advisor Dominic Cull says that such frameworks exist around the world. “Rica is very much a post-9/11 legislation based on the US and European models.”

Cull says that just because there are frameworks in place to monitor communications, it doesn’t mean they’re always used. On the flip side of that coin, it doesn’t mean everyone is adhering to the rules.

In reply to questions from TechCentral, Cell C, MTN and Vodacom all provided generic responses saying they can only act on a surveillance request if it has been approved by a judge within the framework of Rica. Telkom hadn’t submitted a reply by the time of publication.

Cell C spokesman Karin Fourie says lawful interception and monitoring is well defined under Rica. “Cell C adheres to all legal prescripts required under this legislation, including the request of a court order or warrant, when providing information to the state,” she says. “Cell C ensures that warrants and other orders for monitoring and interception are legally correct and properly executed before acting on them.”

MTN says, too, that all surveillance interception requests are done strictly within the framework of Rica. It will only act on a request for lawful interception once a judge’s order has been granted to intercept an MTN subscriber’s communication.

The operator adds that any assistance provided to law enforcement agencies is only done when there is sufficient judicial authority. Also, law enforcement agencies “do not have carte blanche to listen in on conversations or to track the whereabouts of MTN subscribers and Rica guidelines have to be complied with before any interception surveillance can occur.”

Vodacom spokesman Richard Boorman says his company is bound strictly by Rica and the Criminal Procedure Act and the monitoring of communications can only take place within the frameworks they provide.

“More specifically,” Boorman says, “Vodacom would have to be served with a valid subpoena from a designated judge for any form of surveillance to take place.”

But Cull says that the spy tapes scandal in 2009 — which purportedly showed that President Jacob Zuma was the target of a political conspiracy, and which subsequently led to corruption charges against him being dropped — shows that the law isn’t followed at all times. “We would be naive to believe that communication surveillance isn’t happening — especially when you consider what is taking place in the rest of the world.”

Whistleblower Edward Snowden, who blew the lid off mass surveillance by American and British spy agencies, has certainly highlighted this.

“We also need to look at what is happening with Internet service providers in South Africa,” says Cull. “They are getting more requests from the likes of the South African Revenue Service (Sars) and the Financial Services Board.”

Traditionally, these requests came from law enforcement agencies, but service providers are under growing pressure to provide user information to bodies like Sars where there is no judicial oversight. — © 2014 NewsCentral Media